CVE-2026-90621

MediumCVSS 6.3/10Last modified Sep 15, 2026

Description

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function ssh_run_command of the file src/hackingBuddyGPT/extensions/ssh_run_command.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Sep 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-906223.3A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component La CVE-2026-906233.7A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh_co CVE-2026-906247.3An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-CVE-2026-906267.3An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bo CVE-2026-906275.5The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file CVE-2026-906287.3An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack CVE-2026-906297.3An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an inva CVE-2026-90636.7A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This CVE-2026-906313.3Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a doc CVE-2026-906325.5Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStreamer multimedia c CVE-2026-906347.3An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bo CVE-2026-90647.5A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the numbe